tako-cli@0.3.49
Tako CLI — unified launcher for AI coding tools (Claude Code, Codex, Pi, Gemini, Grok Build) with multi-agent session management
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source sends a provider email to the package’s analytics service during ordinary startup, while describing telemetry as anonymous. This is suspicious identifying telemetry, but the reviewed source does not establish credential or application-content theft.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Normal CLI startup when telemetry has not been disabled.
Impact
The package’s analytics service receives account-identifying information without clear disclosure of that field.
Mechanism
The CLI identifies an analytics profile and includes a provider email with environment metadata in requests to https://op.shiroha.tech/api.
AI rationale
The source sends a provider email to the package’s analytics service during ordinary startup, while describing telemetry as anonymous. This is suspicious identifying telemetry, but the reviewed source does not establish credential or application-content theft.
Evidence
dist/index.js
Network endpoints1
op.shiroha.tech/api
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is enabled by default unless the saved setting explicitly disables it.
- Startup identification sends a configured provider’s email along with region, locale, platform, and architecture.
- Analytics uses the package endpoint https://op.shiroha.tech/api.
- The CLI invokes telemetry identification and a cli_started event during normal startup.
- The UI describes telemetry as anonymous usage data and provides a toggle, while the implementation sends email.
Evidence against
- The source shows no automatic transmission of API credentials, prompts, code, or command output in the telemetry path.
- The UI exposes a telemetry toggle, and the package describes the data as anonymous.
- Provider credentials are used for configured provider operations; the reviewed credential paths did not establish credential exfiltration.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
15 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: // @bun
L3: var XM=Object.create;var{getPrototypeOf:$M,defineProperty:Zv,getOwnPropertyNames:ZM}=Object;var eS=Object.prototype.hasOwnProperty;function e_(e){return this[e]}var t_,n_,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function C_(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);return{update(s){if(s===a)return;if(a=s,o)i(`\r\x1B[2K
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22// @bun
L3: var XM=Object.create;var{getPrototypeOf:$M,defineProperty:Zv,getOwnPropertyNames:ZM}=Object;var eS=Object.prototype.hasOwnProperty;function e_(e){return this[e]}var t_,n_,Be=(e,o,i...
L4: `).map((a)=>a.trim().replace(/\r$/,"")).filter(Boolean);if(o!=="win32")return i[0];return i.find((a)=>a.toLowerCase().endsWith(".exe"))??i.find((a)=>a.toLowerCase().endsWith(".cmd"...
...
L266: * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
L267: */});function C_(e){let o=[];for(let[i,a]of Object.entries(e)){if(!a?.models)continue;for(let[s,u]of Object.entries(a.models)){let d=u?.limit?.context;if(typeof d!=="number"||d<=0)...
L268: `);return{update(s){if(s===a)return;if(a=s,o)i(`\r\x1B[2K\u23F3 ${s}`);else i(`\u23F3 ${s}
...
L290:
L291: `).trim()}function YS(e,o){
Findings
4 Critical10 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to tako-cli@0.3.49.
See all versions of tako-cli for other recorded verdicts.
- Review the evidence and your use of tako-cli@0.3.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.